<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<TITLE>
  Release 2.8.0
</TITLE>
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>Release 2.8.0</H1>

<H2>Filters Removal</H2>
Deprecated since ZAP 2.4.0 the Filters functionality, that allowed to change/access some HTTP messages sent/received through
ZAP, has now been removed, the same and much more can be achieved with scripts and Replacer add-on.

<H2>Command Line Changes</H2>
<h3>-dir &lt;dir&gt;</h3>
To prevent add-ons (inadvertently) use/override core files ZAP will no longer start (and show an error) if the home and the
installation directories are the same.

<h3>Client Certificate Handling</h3>
It is now possible to set the Client Certificate from the command line with the following switches:
<pre>
-config certificate.use=true
-config certificate.pkcs12.path=/path/to/file.p12
-config certificate.pkcs12.password=WhateverThePasswordIs
-config certificate.pkcs12.index=1
-config certificate.persist=true
</pre>
<p>
<code>-config certificate.pkcs12.index</code> is only necessary if the file contains multiple certificates 
and you wish to use one other than the first. Index values start at zero (0) which is the first certificate
in the file.<br><br>
<code>-config certificate.persist=true</code> is only necessary if you would like the settings persisted in ZAP's regular 
configuration file (so that they apply for subsequent ZAP use).
</p>

<H2>Changes in Bundled Libraries</H2>
The following libraries are no longer being bundled with ZAP (core):
<ul>
  <li>BrowserLauncher2, it was replaced with the usage of JRE class <code>java.awt.Desktop</code>. Add-ons should use that class or bundle the library.</li>
  <li>HttpComponents Client/Core, no longer in use by core, any add-ons that require them should bundle them.</li>
  <li>JavaFX runtime, now relying on JRE (for example, OracleJDK, OpenJDK+OpenJFX).</li>
</ul>

<H2>Active Scan Input Vectors Change</H2>
Users now have the option of whether or not to add a query parameter to GET requests that did not have them to start with.
In previous versions this behavior was not user controllable and was on by default. With the new user option the default has 
been changed to off.

<H2>JSON Report Change</H2>
For consistency the <code>site</code> property will be always an array regardless of the number of sites that the report contains,
previously it would be an object if only one site and an array if more than one.

<H2>Display Options - Font Controls</H2>
In the Options dialog Display panel it is now possible for the user to select a General font and size for ZAPs GUI, 
as well as a Work Panel font and size used for the top right section of ZAP's main window (Ex: Request/Response, the 
Edit and Resend tool, etc.).

<H2>Enhancements</H2>

<H2>Bug Fixes</H2>

<H2>ZAP API Breaking Changes:</H2>

<H3>VIEW acsrf / optionTokensNames</H3>

This change will break the consumers that were manually parsing/extracting the names from the string. The structure of the data
returned was changed to properly separate each name:
<blockquote><pre><code>
{"optionTokensNames":["anticsrf","CSRFToken"]}
</code></pre></blockquote>
and:
<blockquote><pre><code>
&lt;optionTokensNames type="list"&gt;
    &lt;tokenName&gt;anticsrf&lt;/tokenName&gt;
    &lt;tokenName&gt;CSRFToken&lt;/tokenName&gt;
&lt;/optionTokensNames&gt;
</code></pre></blockquote>

instead of:
<blockquote><pre><code>
{"TokensNames":"[anticsrf, CSRFToken]"}
</code></pre></blockquote>
and:
<blockquote><pre><code>
&lt;optionTokensNames&gt;[anticsrf, CSRFToken]&lt;/optionTokensNames&gt;
</code></pre></blockquote>

<H3>VIEW authentication / getAuthenticationMethod</H3>

This change will break the consumers that were manually parsing/extracting the JSON response (and XML response, for manual
authentication method). The structure of the data was changed to have an object wrap the authentication method data, to be
consistent with all other views. The returned data would be, for example:
<blockquote><pre><code>
{
  "method": {
    "port": "443",
    "host": "example.com",
    "methodName": "httpAuthentication",
    "realm": "example"
  }
}
</code></pre></blockquote>

instead of:
<blockquote><pre><code>
{
  "port": "443",
  "host": "example.com",
  "methodName": "httpAuthentication",
  "realm": "example"
}
</code></pre></blockquote>

<H3>VIEW core / alertsSummary</H3>

This change will break the consumers that were manually parsing/extracting the JSON response. The structure of the data was
changed to have an object wrap the alerts summary, to be consistent with all other views. The returned data would be, for
example:
<blockquote><pre><code>
{
  "alertsSummary": {
    "High": 0,
    "Low": 3,
    "Medium": 1,
    "Informational": 1
  }
}
</code></pre></blockquote>

instead of:
<blockquote><pre><code>
{
  "High": 0,
  "Low": 3,
  "Medium": 1,
  "Informational": 1
}
</code></pre></blockquote>

<H3>VIEW core / alerts</H3>
The view will now validate the risk ID, returning an error (ILLEGAL_PARAMETER) if not valid.

<H3>VIEW core / numberOfAlerts</H3>
The view will now validate the risk ID, returning an error (ILLEGAL_PARAMETER) if not valid.

<H2>ZAP API Deprecated Endpoints:</H2>

All alert related core endpoints were deprecated, they are now accessible through a new component <code>alert</code>.

<H2>ZAP API Changed Endpoints:</H2>

<H3>ACTION authentication / setAuthenticationMethod</H3>
The action will no longer remove existing users, instead the user is disabled and its credentials reset if the type of
credentials of the authentication method being set is different.

<H3>ACTION context / excludeContextTechnologies</H3>
The action will now accept the string with technologies even if there are spaces before or after the names, for example:
<blockquote><pre><code>
os.linux, db.mysql
</code></pre></blockquote>
will now be valid.

<H3>ACTION context / includeContextTechnologies</H3>
The action will now accept the string with technologies even if there are spaces before or after the names, for example:
<blockquote><pre><code>
os.linux, db.mysql
</code></pre></blockquote>
will now be valid.

<H3>ACTION core / snapshotSession</H3>
Added optional parameters <code>name</code> and <code>overwrite</code>, to allow to specify a name and overwrite existing files.

<H2>ZAP API New Endpoints:</H2>

<H3>View ascan / optionAddQueryParam</H3>
Tells whether or not the active scanner should add a query parameter to GET request that don't have parameters to start with.

<H3>VIEW autoupdate / localAddons</H3>
Returns a list with all local add-ons, installed or not.

<H3>VIEW context / urls</H3>
Lists the URLs accessed through/by ZAP, that belong to the context with the given name.

<H3>VIEW httpSessions / defaultSessionTokens</H3>
Gets the default session tokens.

<H3>VIEW pscan / maxAlertsPerRule</H3>
Gets the maximum number of alerts a passive scan rule should raise.

<H3>VIEW script / globalVar</H3>
Gets the value of the global variable with the given key. Returns an API error (DOES_NOT_EXIST) if no value was previously set.

<H3>VIEW script / globalVars</H3>
Gets all the global variables (key/value pairs).

<H3>VIEW script / listTypes</H3>
Lists the script types available.

<H3>VIEW script / scriptVar</H3>
Gets the value of the variable with the given key for the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists or if no value was previously set.

<H3>VIEW script / scriptVars</H3>
Gets all the variables (key/value pairs) of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

<H3>ACTION ascan / setOptionAddQueryParam</H3>
Sets whether or not the active scanner should add a query param to GET requests which do not have parameters to start with.

<H3>ACTION core / enablePKCS12ClientCertificate </H3>
Enables use of a PKCS12 client certificate for the certificate with the given file system path, password, and optional index.

<H3>ACTION core / disableClientCertificate</H3>
Disables the option for use of client certificates.

<H3>ACTION httpSessions / addDefaultSessionToken</H3>
Adds a default session token with the given name and enabled state.

<H3>ACTION httpSessions / removeDefaultSessionToken</H3>
Removes the default session token with the given name.

<H3>ACTION httpSessions / setDefaultSessionTokenEnabled</H3>
Sets whether or not the default session token with the given name is enabled.

<H3>ACTION pscan / setMaxAlertsPerRule</H3>
Sets the maximum number of alerts a passive scan rule should raise.

<H3>ACTION script / clearGlobalVar</H3>
Clears the global variable with the given key.

<H3>ACTION script / clearGlobalVars</H3>
Clears the global variables.

<H3>ACTION script / clearScriptVar</H3>
Clears the variable with the given key of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

<H3>ACTION script / clearScriptVars</H3>
Clears the variables of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

<H3>ACTION script / setGlobalVar</H3>
Sets the value of the global variable with the given key.

<H3>ACTION script / setScriptVar</H3>
Sets the value of the variable with the given key of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

<H2>See also</H2>
<table>
<tr><td>&nbsp;&nbsp;&nbsp;&nbsp;</td><td><a href="../intro.html">Introduction</a></td><td>the introduction to ZAP</td></tr>
<tr><td>&nbsp;&nbsp;&nbsp;&nbsp;</td><td><a href="releases.html">Releases</a></td><td>the full set of releases</td></tr>
<tr><td>&nbsp;&nbsp;&nbsp;&nbsp;</td><td><a href="../credits.html">Credits</a></td><td>the people and groups who have made this release possible</td></tr>
</table>
</BODY>
</HTML>